LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-12-2007, 12:31 PM   #1
Ammad
Member
 
Registered: Apr 2004
Distribution: redhat 9.0, fc4, redhat as 4
Posts: 522

Rep: Reputation: 31
iptables and port scan


i am using linux as firewall and transparent proxy, yesterday when i browsed a site. http://www.whatismyipaddress.com

i surprised to see my private ip address. it also told me;

1. public ip address
2. private ip address
3. linux version + squid version
4. linux hostname


is this possible to hide 2,3,4 from this site using iptables?
 
Old 06-12-2007, 03:10 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
is this possible to hide 2,3,4 from this site using iptables?
What you need is not iptables but to route your traffic through an anonymous proxy: TOR, JAP or find lists of proxies with your favourite searchengine. (Nota bene: this is not a Linux Security question).
 
Old 06-12-2007, 03:11 PM   #3
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
iptables won't work for this because the info in question is in the HTTP headers being sent to the server from your box... the most common approach i know of to deal with these "information disclosure" issues is to use a proxy server to filter (or edit) your HTTP headers... privoxy is specially-made for situations like this, but even a generic proxy like squid can be configured to control HTTP headers (look into the header_access options)... for example:
Code:
acl example_name dstdomain .example.com
header_access User-Agent deny example_name
the above in squid would prevent the User-Agent HTTP header from being sent to anywhere in the example.com domain... you can, of course, make it stop for all connections also, with something like:
Code:
header_access User-Agent deny all
usually it takes a little bit of time for you to find the best amount of header filtering for you... oh, and here's an example of how to edit a header:
Code:
header_replace User-Agent Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.7.5) Gecko/20041202 Firefox/1.0
when this is used with the previous .example.com example, the header will be replaced instead of just filtered...

sometimes you'll HAVE to edit a header instead of filtering it because a server you want to use won't let you work without the header... well, at least that's been my experience... =)

NOTE: my suggestion only addresses points #2, #3, and #4 - to address point #1 you'd need to add software such as Tor (as mentioned by unSpawn) into the mix...

Last edited by win32sux; 06-12-2007 at 03:26 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
mysqld running and reading for connections on port 3306, no port 3306 found from scan darkenigmaa Linux - Networking 10 07-13-2016 11:53 AM
best port scanner To scan open port in a network tanveer Linux - Security 8 01-21-2007 08:19 PM
Port Scan: Closed Port instead of Stealth unihiekka Linux - Security 9 12-26-2005 08:51 PM
Port Scan Detectors for IPTables Artimus Linux - Security 3 03-03-2003 04:57 PM
Port scan luser Linux - Networking 4 10-11-2002 01:37 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:56 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration